1
0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2024-12-23 12:43:46 +02:00

avcodec/cavsdec: Set ret on errors in decode_pic()

Fixes regression and fate failure on some machienes

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2019-10-17 13:05:24 +02:00
parent 097c917c14
commit 0279e727e9
2 changed files with 13 additions and 5 deletions

View File

@ -1102,15 +1102,19 @@ static int decode_pic(AVSContext *h)
if (check_for_slice(h)) if (check_for_slice(h))
skip_count = -1; skip_count = -1;
if (h->skip_mode_flag && (skip_count < 0)) { if (h->skip_mode_flag && (skip_count < 0)) {
if (get_bits_left(&h->gb) < 1) if (get_bits_left(&h->gb) < 1) {
ret = AVERROR_INVALIDDATA;
break; break;
}
skip_count = get_ue_golomb(&h->gb); skip_count = get_ue_golomb(&h->gb);
} }
if (h->skip_mode_flag && skip_count--) { if (h->skip_mode_flag && skip_count--) {
decode_mb_p(h, P_SKIP); decode_mb_p(h, P_SKIP);
} else { } else {
if (get_bits_left(&h->gb) < 1) if (get_bits_left(&h->gb) < 1) {
ret = AVERROR_INVALIDDATA;
break; break;
}
mb_type = get_ue_golomb(&h->gb) + P_SKIP + h->skip_mode_flag; mb_type = get_ue_golomb(&h->gb) + P_SKIP + h->skip_mode_flag;
if (mb_type > P_8X8) if (mb_type > P_8X8)
ret = decode_mb_i(h, mb_type - P_8X8 - 1); ret = decode_mb_i(h, mb_type - P_8X8 - 1);
@ -1125,15 +1129,19 @@ static int decode_pic(AVSContext *h)
if (check_for_slice(h)) if (check_for_slice(h))
skip_count = -1; skip_count = -1;
if (h->skip_mode_flag && (skip_count < 0)) { if (h->skip_mode_flag && (skip_count < 0)) {
if (get_bits_left(&h->gb) < 1) if (get_bits_left(&h->gb) < 1) {
ret = AVERROR_INVALIDDATA;
break; break;
}
skip_count = get_ue_golomb(&h->gb); skip_count = get_ue_golomb(&h->gb);
} }
if (h->skip_mode_flag && skip_count--) { if (h->skip_mode_flag && skip_count--) {
ret = decode_mb_b(h, B_SKIP); ret = decode_mb_b(h, B_SKIP);
} else { } else {
if (get_bits_left(&h->gb) < 1) if (get_bits_left(&h->gb) < 1) {
ret = AVERROR_INVALIDDATA;
break; break;
}
mb_type = get_ue_golomb(&h->gb) + B_SKIP + h->skip_mode_flag; mb_type = get_ue_golomb(&h->gb) + B_SKIP + h->skip_mode_flag;
if (mb_type > B_8X8) if (mb_type > B_8X8)
ret = decode_mb_i(h, mb_type - B_8X8 - 1); ret = decode_mb_i(h, mb_type - B_8X8 - 1);

View File

@ -172,4 +172,4 @@
0, 166, 166, 1, 622080, 0x05496a5d 0, 166, 166, 1, 622080, 0x05496a5d
0, 167, 167, 1, 622080, 0xdcb4cee8 0, 167, 167, 1, 622080, 0xdcb4cee8
0, 168, 168, 1, 622080, 0xb41172e5 0, 168, 168, 1, 622080, 0xb41172e5
0, 169, 169, 1, 622080, 0x26146e0b 0, 169, 169, 1, 622080, 0x84ff3af9